Hospital Price Transparency Compliance Requirements Explained

Since January 1, 2021, every hospital operating in the United States has been required to publish its prices — not just a chargemaster buried in a PDF, but standard charges in a specific machine-readable format, plus a consumer-friendly display of common "shoppable" services. CMS has steadily tightened both the technical requirements and the enforcement behind this rule ever since, with another significant update taking effect in 2026. For compliance and revenue cycle teams, this isn't a one-time publishing task; it's an ongoing data-quality and enforcement obligation. Here's what the rule actually requires, what the penalties look like, and where enforcement stands right now.

The Two Core Requirements

CMS's hospital price transparency rule, issued under Section 2718(e) of the Affordable Care Act, requires every Medicare-participating hospital to make two things publicly available on its website, free of charge, without requiring a login:

• A comprehensive machine-readable file (MRF) listing standard charges for every item and service the hospital provides, including gross charges, the hospital's discounted cash price, payer-specific negotiated charges, and de-identified minimum and maximum negotiated charges.
• A shoppable services display presenting prices for at least 300 "shoppable" services — services that can be scheduled in advance — in a consumer-friendly format. CMS specifies 70 of these services directly; hospitals select the remaining number themselves (or, if they don't offer 300 shoppable services, they must display as many of the 70 CMS-specified services as they provide). A hospital can satisfy this requirement with a price estimator tool instead, provided it meets CMS's functional requirements.

How Enforcement Penalties Work

CMS increased penalties significantly starting in 2022, moving from a flat daily maximum to a tiered structure based on hospital size:

• Hospitals with 30 beds or fewer face a minimum penalty of $300 per day of noncompliance.
• Larger hospitals face an additional $10 per bed per day above the 30-bed threshold.
• The maximum penalty is capped at $5,500 per day, reached by hospitals with 550 or more beds.

Run for a full year of noncompliance, that daily maximum works out to just over $2 million for the largest hospitals — a figure CMS has cited directly when explaining why it strengthened the penalty structure. Beyond the dollar penalty, CMS publishes a public list of hospitals that have received civil monetary penalties, which carries its own reputational cost.

The Enforcement Process

CMS doesn't jump straight to a penalty. Its enforcement process typically follows a sequence: CMS monitors hospital websites directly and responds to consumer complaints; if a hospital appears noncompliant, CMS issues a written warning notice; if the issue isn't resolved, CMS can require a corrective action plan (CAP) with a compliance deadline, historically around 90 days; only after a hospital fails to comply with a CAP does CMS move to a civil monetary penalty. Under recent updates, a hospital that waives its right to an administrative law judge hearing within 30 days of a penalty notice can receive a 35% reduction in the assessed penalty — though this reduction doesn't apply to the most serious, repeated compliance failures.

What's Changing for 2026

CMS finalized a further round of updates to the machine-readable file requirements that take effect for reporting purposes in 2026, with enforcement of the new requirements beginning April 1, 2026. The key changes include:

• Actual prices instead of estimates. Rather than reporting estimated allowed amounts, hospitals must disclose historically-based payment data: the median allowed amount, the 10th and 90th percentile allowed amounts (based on a 12–15 month lookback period), and the count of remittances used to calculate those figures.
• A standard identifier. Hospitals must include their organizational National Provider Identifier (NPI) in the machine-readable file, making it easier for researchers and CMS to match pricing data to specific facilities across datasets.
• A stronger attestation. Hospitals must attest that the posted data is "true, accurate, and complete," confirm all payer-specific charges are expressed in dollar amounts (or, where a formula is used, provide enough detail for the public to calculate the dollar amount themselves), and name the CEO or another senior official responsible for the accuracy of the data.

Who Needs to Be Trained

• Revenue cycle and patient financial services staff who maintain chargemaster and negotiated-rate data feeding the MRF
• IT and web teams responsible for publishing and maintaining the machine-readable file and shoppable services display in the required format
• Compliance officers who track CMS communications, warning notices, and corrective action deadlines
• Hospital executives, since the 2026 update requires naming a specific accountable senior official for MRF accuracy
• Front-line patient financial counselors who field questions from patients trying to use the shoppable services tool

Building a Compliance Program Around This Rule

Because the technical requirements change with each annual CMS payment rule, price transparency compliance works best as a standing program rather than a one-time project. That means assigning clear ownership, building a recurring data validation check into the revenue cycle calendar, and training staff to recognize when contract or pricing changes need to flow through to the published files. This overlaps closely with broader hospital compliance obligations we cover in our guide to Medicare Conditions of Participation for hospitals, and it's a good example of the kind of cross-functional discipline described in our piece on building a culture of compliance in healthcare.

Because pricing transparency and patient billing protections increasingly overlap — a patient comparing a shoppable services price is often the same patient entitled to a good faith estimate — many hospitals train revenue cycle staff on this rule alongside the No Surprises Act's good faith estimate requirements. Structured CPD courses give compliance teams a documented way to show that the staff maintaining and explaining pricing data are actually trained on the rule, not just following a template someone set up in 2021.

FAQ

Does this rule apply to physician offices or only hospitals?

The CMS hospital price transparency rule applies specifically to hospitals. Physician offices and other non-hospital providers are subject to different transparency obligations under the No Surprises Act's good faith estimate requirements, not this rule.

What format does the machine-readable file need to be in?

CMS requires a specific structured format (CSV, JSON, or XML) following a published data dictionary, discoverable without a login and without requiring the user to search or scroll through unrelated content to find it.

Can a hospital be penalized even if its file exists but has errors?

Yes. CMS enforcement has increasingly focused on data quality, not just the existence of a file. The 2026 attestation requirement, which requires hospitals to affirm their data is true, accurate, and complete, reflects this shift directly.

How does CMS find out a hospital is noncompliant?

Through a combination of routine monitoring of hospital websites and complaints submitted by consumers, researchers, and competitors directly to CMS.

Price transparency compliance has moved well past "post a spreadsheet and move on." With actual claims data, standardized identifiers, and named executive accountability arriving in 2026, hospitals need a maintained, well-documented process behind their published files — and staff who understand why the numbers matter, not just where to upload them.